How can I hide the workflow transition/operations from public users?

Ken Nguyen4

I have a page viewable by public on which there is a jiraissue macro. Since each issue is a link public users can follow this to view the issue in Jira. I was expected that they can only view the issue according to the permission schemes I have set but still the workflow transition is not only visible but the workflow operations such as the Edit button is enabled to them. This is obviously not acceptable.

Could anyone please let me know how to fix this?

Nic Brough -Adaptavist-

This is mostly down to permissions.

The first question is "are your users logging in?". If they are, then you need to chop down your permission schemes a bit to remove the abilitues they are getting via their user account (groups, roles, etc)

If not, then you've got "browse = anyone" in your permission scheme, which is fine because it allows anonymous read access, but you've probably used "anyone" in other permissions too - edit is one of them. Remove the "anyone" and cut it all down to logged-in known users.

The workflow transitions are a similar principle, but you need to look in a different place. Open up the workflow(s) and look at the transitions. You'll probably find that they have no *conditions* or they have *conditions* like "allow people with resolve permission". In the first case, you need to add a condition that will prevent non-logged in users from doing it - the most simple way to do that is simply whack in "user is in group jira-users", as that's the "can log in" group, but you might actually want to cut it down to something even more restrictive. In the second case, you could do the same as the first case, but also think about why they're getting those permissions.